CVE-2026-109170 LogicalDOC CVE debrief

Who should care

System administrators and security teams responsible for LogicalDOC Community Edition deployments should assess exposure and apply the patch to prevent potential unauthorized access to sensitive data. They should also review compensating controls for exposed systems and monitor for suspicious activity on the affected system.

Why it matters

This vulnerability allows authenticated users to manipulate queries and potentially access sensitive data. System administrators and security teams should assess exposure and apply the patch to prevent potential unauthorized access.

• Potential unauthorized access to sensitive data
• Bypassing of folder scope and read-permission checks
• Possible extraction of database contents

Technical summary

The vulnerability is caused by an HQL injection in the DocumentsDataServlet of LogicalDOC Community Edition through 9.3. This allows authenticated users to manipulate queries via the unvalidated indexed parameter. The vulnerability enables attackers to inject boolean HQL expressions, potentially bypassing folder scope and read-permission checks, and leading to unauthorized access to sensitive data and possible extraction of database contents. The patch commit is available in the source references to address the vulnerability.

Defensive priority

Authenticated users with read access to any folder may be able to inject boolean HQL expressions to bypass folder scope and read-permission checks.

Recommended defensive actions

• Review and apply the patch commit to ensure the vulnerability is addressed
• Restrict access to the DocumentsDataServlet to only trusted users
• Monitor for suspicious activity on the affected system
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. Supplemental sources include technical descriptions and a patch commit. The vulnerability has been confirmed in LogicalDOC Community Edition through version 9.3. Authenticated users with read access to any folder may be able to inject boolean HQL expressions to bypass folder scope and read-permission checks. The patch commit is available in the source references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.